Overview
This policy covers the tokyyy customer app, which you use to hold a tokyyy card, see your token balance, top it up and send tokens to other people at participating venues and events (“Venues”). It is written for members of the public who use the app for themselves.
It does not cover the separate tokyyy Manager app used by Venue staff, which has its own privacy policy.
The data controller is Music Reactions d.o.o., VAT ID HR22145840365.
Information we process
Account information: your email address and a password, which you provide when you create an account. Passwords are stored only in hashed form.
Profile information: a username, your name, phone number, gender, date of birth, country and city. These are requested when you complete your profile. You may also add a profile photo, which is optional.
Transaction PIN: a short code you set to authorise payments and transfers. It is stored hashed and is never visible to us or to Venue staff.
Card information: the identifier of each card you link (the chip ID of a physical NFC card), the card’s name and its token balance. Balances and history are held on our servers; the card itself holds only an identifier.
Transaction data: your top-ups, purchases at a Venue, and tokens sent to or received from other users, including amounts, dates and the Venue involved.
Payment data: when you top up by card in the app, we record the amount, the currency, the payment’s status, and the brand and last four digits of the card used. We never receive or store your full card number — card details are entered directly into Stripe’s payment sheet.
Technical data: basic device and log information needed to operate and secure the service.
The app contains no advertising and no analytics or tracking software.
How we use information
To create and operate your account; to authenticate you; to link cards and keep their balances; to process top-ups, purchases and transfers; to show your history; to issue receipts and invoices where required; to provide support; and to keep the service secure and prevent misuse.
Deleting your account
You can delete your account at any time from Profile → Delete account, without contacting us. Your personal details are erased, and any cards linked to your account are released.
Records of completed payments and the invoices issued for them are kept, because accounting and fiscal law requires it. These records are retained without the personal details that identified you.
Data retention
We keep your account and transaction data for as long as your account exists, and afterwards only where a legal or accounting obligation requires it.
Security
We protect data in transit using HTTPS and apply industry-standard measures to safeguard data at rest. Balances and transaction history are kept server-side, so a lost card cannot expose them, and the sign-in token on your device is held in the operating system’s secure storage.
Children
The app is intended for people aged 18 and over and is not directed to children.
Your rights
You can see and correct your details in the app at any time, and delete your account as described above. You may also contact us at support@tokyyy.com to ask what information we hold about you, to have it corrected, or to object to how it is used.
Changes to this policy
We may update this policy from time to time. The “last updated” date above reflects the latest revision.
Contact
Questions about this policy can be sent to support@tokyyy.com.