Data & Privacy

For the people who enter your promotions, you are the data controller. You decide why the data is collected, who gets contacted, and what happens to it. Tokei is your data processor — we handle entrant data to run the promotion you configured, and for nothing else.

• Tokei never markets to your entrants on its own behalf
• Tokei never sells or rents entrant data
• Tokei never pools one creator's entrants with another's

Tokei is the controller only for your own creator account — billing, login and account settings. The full terms are in our Data Processing Agreement, including the list of sub-processors we use.

• Contact details — the email address and name they submitted, plus the profile details their provider returns if they entered with social login
• Entry records — every action they completed, the points awarded, and when
• Approximate location — country and city derived from their IP address at the moment they entered. This is what powers the location column in your emails dashboard and the country breakdown in analytics.
• A hashed IP — an irreversible fingerprint used only to detect duplicate and fraudulent entries. Tokei does not keep the raw IP address on an entry record.
• Technical details — browser user agent and referring page, attached to entry records
• Consent record — whether they ticked the optional marketing checkbox, when, and the exact wording they were shown

Entrants are scoped to a single promotion. Tokei does not maintain an account-level contact list across your promotions — someone who enters two of your promotions is two separate entrant records.

Entrant data is retained for 90 days after a promotion ends. After that, a nightly job automatically anonymizes it. This runs on every promotion — you do not need to request it, and you cannot opt out of it.

Anonymizing rather than deleting is deliberate: it strips every identifier while leaving your reporting intact, so a promotion that finished last year still shows the right entry counts and winner history.

Someone entering your giveaway has agreed to enter your giveaway. That is not, on its own, permission to add them to a marketing list. Tokei treats these as two separate things.

You can turn on an optional marketing consent checkboxin your promotion's compliance settings. It is never required to enter, and it is never pre-ticked. Every entrant record then carries one of three states:

• Not shown — the checkbox was switched off for that promotion, so no choice was ever offered
• Declined — the checkbox was shown and they left it unticked
• Granted — they ticked it. Tokei also records the moment and the exact wording version they agreed to, so you have an audit trail.

Tokei does not send marketing to your entrants. The only entrant-facing emails it sends are transactional — confirming an email address, or welcoming a returning entrant. Your marketing goes out from youremail provider, under your own sender identity, with that provider's own unsubscribe link.

That means unsubscribes can arrive from two directions, and Tokei records both:

• From your email provider — when someone unsubscribes from a campaign you sent, that provider notifies Tokei and the entrant is marked as unsubscribed here too, so a later sync cannot quietly re-add them
• From Tokei — a signed, non-expiring opt-out link that marks the entrant record directly

As the controller, these are yours to get right:

• Have a lawful basis for contacting the people on your list, and be able to show it
• Tell entrants what you will do with their data at the point you collect it — your own privacy notice, linked from your promotion
• Honour opt-outs everywhere, including on lists you exported before someone unsubscribed
• Respond to data-subject requests from your entrants. Contact us and we will help with anything the dashboard cannot do itself.
• Check the rules where you are promoting — prize-promotion law is local. See Blocking Regions if you need to restrict entry by country.