Privacy Notice

⚠️ PREVIEW DRAFT — under legal review. This document is a good-faith draft pending review by qualified legal counsel. By using Tokonomix you agree to these provisions as a binding contract; substantial changes will be communicated by email and accompanied by a version bump. Last updated: 2026-10-14.

Privacy Notice

This Privacy Notice explains how Tokonomix processes personal data when you visit our website, create an account, or use the Tokonomix API. It is issued in compliance with Regulation (EU) 2016/679 (the "GDPR") and the Dutch Implementation Act (UAVG).

1. Controller

The controller of your personal data is:

InterIP Networks B.V. (trading as Tokonomix) Registered office: Linnewever 18, 2292 JH Wateringen, the Netherlands. Chamber of Commerce (KvK): 27183782 VAT identification number: NL813181811B01 General contact: support@tokonomix.ai Privacy contact: privacy@tokonomix.ai

2. Data Protection Officer

You can reach our Data Protection Officer at dpo@tokonomix.ai. The DPO mailbox is monitored on business days; responses to formal subject-rights requests are issued within the GDPR statutory one-month period (Art. 12(3) GDPR).

Operational note: the DPO mailbox is being provisioned during the preview period. Until provisioning completes, requests sent to this address are auto-forwarded to privacy@tokonomix.ai — no messages are lost.

3. Purposes & Lawful Basis

We process personal data for the purposes set out below. The lawful bases relied on are listed alongside each purpose pursuant to Article 6(1) GDPR.

  • Creating and authenticating your account — Contract, Art. 6(1)(b).
  • Routing API calls and metering Credit consumption — Contract, Art. 6(1)(b).
  • Keeping your Studio conversations, pictures, photos and saved videos for you — Contract, Art. 6(1)(b).
  • Processing payments via Stripe and Pay.nl — Contract, Art. 6(1)(b).
  • Detecting fraud, abuse, and account stuffing — Legitimate interest, Art. 6(1)(f).
  • Complying with tax, accounting, and anti-money-laundering law — Legal obligation, Art. 6(1)(c).
  • Sending product announcements and editorial updates — Consent, Art. 6(1)(a).
  • Analytics and performance measurement (if you opt in) — Consent, Art. 6(1)(a).

Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

4. Categories of Personal Data

We process the following categories of personal data:

  • Identification data — full name, email address, account preferences;
  • Authentication data — salted password hashes, second-factor secrets encrypted at rest, recovery-code hashes;
  • Billing data — VAT number, company name, billing address, payment-token references issued by our payment providers (we do not store full card or bank-account numbers);
  • Usage data — API requests, model selections, token counts, latency measurements, response status codes, derived cost figures;
  • Technical data — IP address, user-agent string, browser-language header, session cookie identifiers;
  • Communication data — content of support and abuse-report tickets;
  • Generated videos — the video files and poster images you create through the API, stored so that you can download them;
  • Studio content — when you use the Studio on our website: your conversations (your questions and the answers), the pictures drawn for you, the photos you upload, the videos you save to your gallery, and, for a video made in a conversation, the question it was made from and its start photo, kept in that conversation;
  • Abuse-investigation data — in the two situations described below, and to protect the service against fraud and automated abuse, the content of the requests sent from an account. We store the text of each message (clipped to the first 4 000 characters, and at most 100 messages per request), the number of messages, the untruncated total length, the models requested, the request identifier, the originating IP address and the user-agent string. Attached images are recorded only as a placeholder, never the image itself. We apply this in two situations, and in no others, apart from the exception for blocked video requests at the end of this item. First, to individually designated accounts under an active investigation, for as long as that investigation runs. Second, to every new account during a short first-use window: approximately its first fifty (50) requests within fourteen (14) days of sign-up, whichever limit is reached first, after which the capture ends by itself and is not resumed unless the account is individually designated. Established accounts outside such a designation are not captured at all, apart from that exception. For a new account that has not yet made a payment, we also compare each request in its first fourteen (14) days automatically with the exact wording of misuse prompts we have seen before. A word-for-word match suspends the account at once and the request is refused. A person reviews every such suspension, and you can write to support@tokonomix.ai to have it reconsidered. Our lawful basis is our legitimate interest in preventing fraud against, and abuse of, the service (Article 6(1)(f) GDPR); we have carried out a balancing test and record it with each designation. You may object under Article 21, and we will stop unless we can demonstrate compelling legitimate grounds — in an active fraud investigation we may be able to. When a video request is captured, the stored text is its prompt. For every video request, we keep the prompt, and a transcript of any speech in the generated video, encrypted until the video is finished (at most about two hours). If the video is blocked for its content, we keep that prompt and transcript as abuse-investigation request content for any account, designated or not, on the same lawful basis and with the same retention; we have carried out a balancing test for this category of request. Otherwise both are deleted. This encrypted copy is separate from your Studio conversation: when you make a video in the Studio, its question and start photo also stay in that conversation, as Studio content (see Retention).

If you send another person's personal data inside a prompt, we normally handle it strictly on your instructions as your processor. Where such a prompt is captured under an abuse investigation, we process that content for our own purpose and are the controller for it. This is one more reason not to place other people's personal data — and never special categories of it — in prompts.

We do not knowingly process special categories of personal data under Article 9 GDPR; you should not submit such data through prompts.

5. Recipients & Sub-processors

We disclose personal data only to the recipients and sub-processors listed below, all of whom are bound by data-processing agreements compliant with Article 28 GDPR.

Payments

  • Stripe Payments Europe, Ltd. — card payments — Ireland (EEA).
  • Pay.nl — iDEAL and SEPA payments — Netherlands (EEA).

AI model providers — your prompts, any photo or file you attach to them, and the model's answers are sent to the provider of each model that handles your request:

  • Anthropic, PBC — Claude models — United States.
  • OpenAI OpCo, LLC — GPT and GPT Image models — United States.
  • Google LLC — Gemini models and Veo video — United States.
  • Microsoft (Azure) — OpenAI models hosted in the EU, and the safety check of prompts, of images (generated, or uploaded for editing or as the start of a video) and video frames, and of speech in generated videos (Azure AI Content Safety) — Sweden (EEA).
  • OVH Groupe SAS — open models hosted in the EU, the safety check of prompts, of images (generated, or uploaded for editing or as the start of a video) and video frames, and of speech in generated videos, and EU object storage for files you upload and the pictures and videos you generate — France (EEA).
  • Black Forest Labs — FLUX image models — Germany (EEA).
  • OpenRouter, Inc. — routing to further model providers — United States.
  • xAI — Grok models — United States.
  • fal.ai — image and video models, and Veo video when Google is temporarily unavailable — United States.
  • Hugging Face, Inc. — open models via its inference router — United States.
  • Z.ai (Zhipu AI) — GLM text, image, video and speech models — China.
  • Alibaba Cloud (DashScope International) — Qwen models — Singapore.

Infrastructure and security

  • WorldStream B.V. — server hosting — Netherlands (EEA).
  • Cloudflare, Inc. — Turnstile bot check on sign-up, sign-in and public demos (IP address and browser signals) — United States.

Our up-to-date sub-processor list is maintained at /en/legal/sub-processors. We notify Customers by email of changes at least fifteen (15) days before a new sub-processor becomes operational, and you may object on legitimate grounds.

6. Retention

We retain personal data only for as long as necessary to achieve the purpose for which it was collected:

  • Account profile — for the lifetime of the account plus thirty (30) days after termination, after which we delete or pseudonymize the profile;
  • Billing records and invoices — seven (7) years from the end of the fiscal year of issue, as required by Article 52 of the Dutch State Taxes Act (Algemene wet inzake rijksbelastingen);
  • API usage logs — ninety (90) days from the request timestamp, after which aggregate statistics are retained but raw rows are deleted;
  • Audit and abuse-detection logs — one (1) year from the event;
  • Abuse-investigation request content — sixty (60) days from the request, and sooner once the related investigation has been concluded, removed by an automated hourly sweep, unless a longer period is necessary to establish, exercise or defend a legal claim;
  • Generated videos — seven (7) days from completion, then deleted by an automated hourly sweep; deleting a video through the API removes it sooner. The model provider may keep its own copy under its own terms;
  • Studio content — your conversations, the pictures drawn for you, the photos you upload and the videos you save to your gallery: until you delete them. Deleting is permanent: the file and its record are removed straight away, there is no recycle bin, and copies in our encrypted backups, which we use only to recover from a disaster, run out with the normal backup cycle, usually within about ten (10) weeks; if we ever have to restore a backup, we delete again what you had deleted. What we keep separately for an abuse investigation, a blocked video or a legal request follows its own period in this list. A video you save to your gallery is kept as a copy with your Studio content; a video you do not save is deleted seven (7) days after it is finished, like any generated video. The model provider may keep its own copy under its own terms. Unused means: no sign-in, no visit to your account, no request and nothing in the Studio. If your account is unused for twelve (12) months, we delete all your Studio content. An account that has never paid us anything (no top-up, subscription or storage pack) is cleared after three (3) months unused instead. Either way, we email you thirty (30) days before, and your account itself stays open. If we cannot reach you by email (an unconfirmed or bouncing address), we delete nothing: your Studio content stays until you sign in again or delete it yourself, and we review such accounts once a year. While you have a paid subscription or a storage pack, we never delete your Studio content automatically; once it ends, the rules above apply again, counted from your last use;
  • Videos blocked as possibly illegal — an encrypted copy, kept as evidence and accessible only to authorised persons, for the period our legal counsel sets, never more than one (1) year from the block, unless a longer period is needed for legal proceedings. A video we must preserve on a legal request (for example from the police) is kept for as long as that request requires, even if you deleted it through the API;
  • Video request records — ninety (90) days from the request, then deleted; for each delivered video only a fingerprint (SHA-256) of the file, with the account and the date, is kept for two (2) years, so that we can show whether a video was made through our service;
  • Support and abuse-report communications — three (3) years from the last interaction, unless a longer retention is required to defend a legal claim.

After the applicable retention period elapses, data is deleted from primary storage and rotated out of backups on the next backup-retention cycle (usually within about ten weeks; a restored backup is cleaned again).

7. Your Rights

Subject to the conditions set out in the GDPR, you have the right to:

  • Access — obtain a copy of the personal data we hold about you (Art. 15);
  • Rectification — correct inaccurate or incomplete data (Art. 16);
  • Erasure — request deletion of data we are no longer entitled to keep (Art. 17);
  • Restriction — request that we limit processing in defined situations (Art. 18);
  • Portability — receive a machine-readable export of data you provided to us under a contract (Art. 20);
  • Object — object to processing based on legitimate interest (Art. 21).

You can exercise these rights by writing to privacy@tokonomix.ai from the email address associated with your account. We will respond within one month of receipt; where requests are complex we may extend by two further months and will inform you of the extension.

You also have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement. The Dutch supervisory authority is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

8. International Transfers

Several of our sub-processors are located outside the European Economic Area: in the United States (Anthropic, OpenAI, Google, OpenRouter, xAI, fal.ai, Hugging Face and Cloudflare), in China (Z.ai) and in Singapore (Alibaba Cloud). Personal data transferred to these recipients is protected by:

  • the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914), incorporated by reference into the relevant data-processing agreement;
  • where applicable, the recipient's certification under the EU-US Data Privacy Framework;
  • transfer-impact assessments and, where appropriate, supplementary technical measures such as encryption in transit and at rest.

You may request a copy of the SCCs covering a specific transfer by writing to privacy@tokonomix.ai.

9. Cookies

We rely on the smallest possible cookie footprint:

  • Strictly necessary cookies — a session-cookie that holds your authentication token after sign-in, plus a CSRF-protection token. These cookies cannot be refused without disabling the Service.
  • Analytics cookies — set only after you give explicit consent through our cookie banner. They allow us to measure aggregate site usage and improve content.
  • Marketing cookies — currently not set; this category is reserved for future opt-in attribution use.

You can change your cookie preferences at any time via the link in the footer of every page. Consent records are stored for one year.

10. Children

The Service is not directed at children under the age of sixteen (16). We do not knowingly collect personal data from a person under that age. If you believe a child has provided personal data to us, please contact privacy@tokonomix.ai and we will delete the data without undue delay.

Changes to this Notice. We may update this Privacy Notice from time to time. When changes are material we will bump the version number, refresh the "last updated" date, and notify active Customers by email at least fourteen (14) days before the change takes effect. The version history is available on request.

Version 1.3.3-preview · Last updated 2026-10-14 · en