Privacy Policy
Last updated: 1 August 2026. Toqool is based in Amsterdam, the Netherlands.
The short version
The business data your connector pulls — orders, products, customers, invoices — never reaches us. It is written to your own disk by software running on your own machine. What we hold is limited to what running a shop requires: your email address, your purchase record, and whether your Keeper is current.
What we collect, and why
- Your email address and (optionally) your name. To deliver the connector you bought, send your receipt, let you sign in, and answer support. Legal basis: performance of our contract with you.
- Your purchase record — which connector, when, the amount, and your Keeper expiry date. Legal basis: contract, and our legal obligation to keep accounting records.
- Payment details are collected and stored by Stripe, not by us. We receive the outcome (paid, refunded, disputed) and the email you gave Stripe. We never see your full card number.
- Support messages and break reports you send us, including any logs you choose to paste in. Legal basis: contract and our legitimate interest in fixing the product.
- Website analytics — only if you accept the cookie banner. See below.
Your business data stays on your machine
A Toqool connector is code that runs on your computer, authenticating with API keys you create yourself. The data it pulls lands in dated CSV files on your own disk. It does not pass through our servers, and we have no way to read it.
Toqool Local, the dashboard on this site, reads those CSV files inside your browser. The files are not uploaded. To keep that promise honest, we run no analytics or session-recording scripts at all on /local, /account or /checkout.
Cookies and analytics
Nothing analytical loads until you choose "Accept" on the banner. Decline, or ignore it, and no analytics or advertising cookies are set. If you do accept, we use:
- Google Analytics 4 — which pages get used.
- Google Ads — to see whether an ad led to a purchase.
- Microsoft Clarity — aggregate heatmaps and session replay, so we can see where the site confuses people. Never loaded on the pages listed above.
You can change your mind by clearing this site's data in your browser, which resets the banner.
Who processes data for us
- Stripe — payments and billing.
- Supabase — our database and file storage (EU region).
- Vercel — hosting and server logs.
- Resend — transactional email (receipts, password resets).
- Google and Microsoft — analytics, only with your consent.
Some of these are US companies and may process data outside the EU under Standard Contractual Clauses. We do not sell your data, and we do not share it for anyone else's marketing.
How long we keep it
- Purchase and invoice records: 7 years, as Dutch tax law requires.
- Your account: until you ask us to delete it.
- Support messages: 2 years.
- Server logs: roughly 30 days, per our hosting provider's retention.
Your rights
Under the GDPR you can ask for a copy of your data, correct it, delete it, restrict or object to processing, or take it elsewhere. Email support@toqool.com and we will respond within 30 days. Deleting your account does not remove invoices we are legally required to retain. You may also complain to the Autoriteit Persoonsgegevens.
Security
Passwords are hashed, never stored in readable form. Connector downloads are served by short-lived signed links from a private bucket and require a valid licence on your account. More detail on the Trust & data page.
Contact
Questions about any of this: support@toqool.com, or the contact page.