Privacy Policy
What Toks.ai collects, who processes it, how long we keep it, and your rights.
Last updated: September 8, 2026
This policy explains what Toks.ai (toksai.co.uk) collects, who else handles it, how long we keep it, and what you can ask us to do about it. It is written in plain language on purpose.
Who We Are
Toks.ai is operated by GLX Technologies LLC, a Wyoming limited liability company (United States), which is the data controller for everything described here.
Registered address: 1309 Coffeen Avenue STE 1200, Sheridan, WY 82801, USA. Privacy contact: [email protected].
What We Collect
When you request a creative pack
The form asks for a product URL, your email address, optionally your name, and any notes you add. We use them to generate your pack and to send it to you, and we keep the request so we can answer a later question about it or honour a revision.
When you play Hook Battle
Your hook choices and the resulting ranking. Hook Battle needs no email address and no account.
When you buy Pack+
Stripe collects and processes your payment details. We never see or store your card number. What reaches us from Stripe is the outcome: an order record with the amount, currency, the last four digits and card brand, your billing country, the email address you gave Stripe, and Stripe’s own identifiers for the payment. We keep order records for as long as US tax and accounting law requires (currently seven years).
When you email us
Your address and whatever you write. We keep the correspondence only as long as needed to deal with it.
Analytics
We use Plausible Analytics, self-hosted on our own infrastructure, to see aggregate statistics: page views, referral sources and device type. Plausible is cookieless, collects no personal data, cannot identify individual visitors, and shares nothing with third parties. We use no Google Analytics, no advertising pixels and no cross-site tracking.
We also load a first-party script that records which images and creative surfaces were shown on a page. It counts impressions against our own assets; it does not identify you.
Cookies
This site sets no cookies of its own and our analytics are cookieless. On the Pack+ checkout page only, Stripe’s embedded checkout sets the cookies it needs to take a payment securely and to prevent fraud. Stripe’s script is not loaded anywhere else on the site, and it is not loaded on the checkout page until you have an active checkout session — so a visitor who never reaches checkout never receives it.
Who Else Processes Your Data
- Stripe, Inc. — payment processing for Pack+, as an independent controller for fraud prevention and as our processor for the payment itself.
- Cloudflare, Inc. — content delivery, TLS and DDoS protection for every request to this site.
- Our own infrastructure — the servers that host this site, the automation that receives your creative request, and the service that generates your pack are operated by GLX Technologies LLC. Your creative request is not sent to a third-party marketing platform.
- Model providers — generating hooks and scripts sends your product URL, the public page content behind it, and your notes to the AI model providers we use for that step. We do not send them your email address, your name or your payment data.
We do not sell your personal data and we do not share it for advertising.
How Long We Keep Things
| What | How long |
|---|---|
| Creative requests and generated packs | Up to 24 months, then deleted |
| Hook Battle results | Up to 24 months, then deleted |
| Order and payment records | 7 years (tax and accounting) |
| Email correspondence | As long as needed to handle it |
| Analytics | Aggregate only — nothing personal to keep |
Your Rights
If you are in the UK, the European Union or the European Economic Area, you have the right to access, correct, delete and port your personal data, to object to or restrict its processing, and to withdraw consent. If you are a California resident, you have the right to know what we collect, to have it deleted, and to opt out of its sale — we sell none.
To exercise any of these rights, email [email protected]. We respond within the statutory windows (30 days under UK GDPR and GDPR, 45 days under the CCPA). You may also complain to your local supervisory authority; in the UK that is the Information Commissioner’s Office.
Order and payment records are the one thing we may not be able to delete on request, because tax law requires us to keep them.
Data Deletion
Email [email protected] with the subject “Data deletion request”. We confirm and delete within 30 days.
International Transfers
We are a US company. Our servers are rented from an international hosting provider, so your data may be processed in the United States, in Europe or in Asia depending on which of our regions serves you, and it is administered from the United States. Where a transfer requires a legal mechanism, we rely on the standard contractual clauses our providers offer.
Children’s Privacy
This site is not directed at children under 13 and we do not knowingly collect personal information from them.
Changes to This Policy
When we change this policy we update this page and revise the “Last updated” date.
Contact
Questions about this policy: [email protected]. See also our Terms of Use.