Privacy policy

• Tokn runs online booking and live queues for appointment-based businesses such as dental practices, clinics, physios, vets, cosmetic clinics and barbers.
• We collect only what’s needed to run a booking: typically your name, mobile number and the appointment you chose.
• Booking forms don’t ask for health information. Clinical records stay with the business, in its own systems.
• We don’t sell or rent personal information, and we don’t use it for third-party advertising or cross-site tracking.
• Our main database is hosted in Australia. Some service providers are overseas (see section 8).
• We use no advertising or tracking cookies. Our visit statistics are cookieless, and you can switch them off (section 9).
• You can ask to access, correct or delete your information, or object to how we use it, by emailing contact@tokn.live. We respond within 30 days.

In this policy, “Tokn”, “we”, “us” and “our” mean the operator of the Tokn service at tokn.live and app.tokn.live. For privacy matters, contact us at contact@tokn.live.

We play two different roles, depending on the information:

• When you book with a business through a Tokn booking page, queue or app, that business decides why and how your booking information is used. It is the controller (in India, the “data fiduciary”; in California, the “business”). Tokn handles that information on the business’s behalf and under its instructions, as a processor or service provider. For questions about how the business uses your information, contact the business directly. We will help it respond.
• For our own purposes, Tokn is the controller. This covers our websites, Tokn user accounts, business accounts and billing, security logs, and our communications with businesses.

This policy is written to meet the Australian Privacy Act 1988 and Australian Privacy Principles; India’s Digital Personal Data Protection Act 2023 and Digital Personal Data Protection Rules 2025; the UK GDPR, Data Protection Act 2018, Data (Use and Access) Act 2025 and Privacy and Electronic Communications Regulations (PECR); US state privacy laws including the California Consumer Privacy Act (CCPA, as amended by the CPRA); New Zealand’s Privacy Act 2020; and the anti-spam laws that apply to our messages.

Information you give us

• Bookings and walk-ins: your name and mobile number; the business, service, practitioner, date and time you chose; and anything you add in an optional field. That might be your pet’s name and species, the name of the person the booking is for, or a short note (up to 280 characters).
• Tokn accounts: the name, email address and profile picture from your Google account (the only way to sign in today), the mobile number you give when booking, saved profiles for people you book for, and your preferences.
• Business accounts: the owner’s and staff members’ names, emails, phone numbers and sign-in details; business details such as address, hours, services, prices and photos; and subscription and billing records.
• Messages to us: anything you send when you email us, reply to our messages or ask for support.

Information created when you use Tokn

• Queue and visit data: your token number, check-in and arrival times, status (for example waiting, in progress, completed, cancelled or no-show), and estimated times.
• Ratings you choose to leave after a visit.
• Payments: when a business pays for a subscription, or you pay for a booking online where the business offers it, the payment is handled by a payment processor. We receive the amount, status and a reference. We never receive or store full card, UPI or bank details. If you pay at the desk, the business records only whether you have paid.
• Device and technical data: IP address, browser and device type, pages requested, timestamps and error logs. If you turn on notifications, we also store a push notification token for your device.
• Visit statistics: our hosting provider’s analytics records the pages viewed, the referring site, country, browser, device type and operating system. It uses no cookies and stores nothing on your device. Visits are grouped using a hash of the request that is discarded after 24 hours, so we see totals and trends, not individual people, and you aren’t tracked across other websites. It doesn’t run if your browser sends a Global Privacy Control or Do Not Track signal, or if you opt out (section 9).

Information we collect only with your permission

• Location: if you allow it, your device location is used to show businesses near you and how far away they are. It is used when the request is made and is not stored as a location history. You can switch it off at any time in your browser or device settings.
• Push notifications: only if you turn them on.

Information from other sources

• From businesses: reception staff may enter your name and mobile number when you walk in or book by phone, mark your arrival and payment status, and keep a profile of the person or pet they serve (for example a pet’s species) with the date your next visit is due, so they can remind you.
• From sign-in providers: if you sign in with Google, we receive your name, email address and profile picture from Google.
• Business contact information from public sources: to tell businesses about Tokn, we may collect business names, roles, and business phone numbers and email addresses. These come from the business’s own website, public directories and public professional profiles. We record where each detail came from, contact businesses only in their professional capacity, and stop immediately if asked.

You don’t have to give us your information. Where it’s practical, such as asking a general question, you can deal with us without identifying yourself or by using a pseudonym. A business can’t hold your place in a queue or confirm a booking without a name and a way to reach you, though.

Tokn is not a medical records system. Our booking forms don’t ask about symptoms, conditions, treatment or other health information. Please don’t include it in notes. Your booking may show that you visited a particular type of business, such as a dental practice or clinic. Some laws, including Australia’s Privacy Act, treat that fact as health information, so we treat it as sensitive: it is used only to run your booking, is visible only to that business and to you, is never used for marketing, and is protected by the security measures in section 10.

We don’t intentionally collect other sensitive information, such as racial or ethnic origin, religious or political beliefs, sexual orientation, biometric or genetic data, or government identifiers. If you include it anyway, we delete it when we become aware of it, unless the business needs it and you have agreed.

We use personal information only for the purposes below, and for purposes directly related to them that you would reasonably expect:

Where we rely on consent, you can withdraw it at any time. That won’t affect anything we did before you withdrew it. In India, where consent is the basis, you can withdraw it as easily as you gave it, by emailing contact@tokn.live.

Automated decisions. Tokn uses software to estimate wait times, suggest when to leave, and suggest who is called next (for example, people who have checked in before those who haven’t arrived). It uses your booking time, token number, check-in and payment status, and the business’s delays. These are suggestions to help the queue run: staff at the business make and can always override the actual decision, and they don’t produce legal or similarly significant effects. We don’t use profiling or AI to make decisions about individuals. If that changes, we will update this section first, as the Australian Privacy Principles require.

• Service messages: booking confirmations, “getting close” and “your turn” alerts, delay updates and cancellations. They appear in the Tokn app and, depending on the business and your choices, arrive as push notifications, WhatsApp messages or text messages (SMS) to the mobile number you gave. They are part of the service, so they don’t carry marketing. You can switch push notifications off in your device settings, or ask the business or us to stop the other alerts.
• Reminders from the business: a business may remind you when a repeat visit is due, by sending a WhatsApp message from its own account. Ask the business if you don’t want these.
• Marketing: we never send marketing to people because they booked with a business on Tokn. When we email businesses about Tokn, each message identifies Tokn, gives our contact details and includes a simple way to unsubscribe. We act on unsubscribe requests within 5 business days (usually immediately), and we keep a minimal suppression record so we don’t contact you again. This meets the Australian Spam Act 2003, the UK PECR, the US CAN-SPAM Act, and similar laws.

We share personal information only as described here:

• The business you book with and its authorised staff, so they can serve you.
• Service providers who host, secure and deliver Tokn for us (listed by type below). They are bound by contract to use the information only to provide their services to us, to keep it secure, and to delete or return it when the service ends. They may not use it for their own purposes.
• Professional advisers, such as lawyers, accountants and auditors, under confidentiality.
• Authorities, where the law requires it, or where it is necessary to protect someone’s life, health or safety, or to establish, exercise or defend legal claims.
• A buyer or successor if Tokn is involved in a merger, acquisition or sale of assets. They would have to protect the information in line with this policy, and we would tell you first.

On shared screens, such as a waiting-room queue display, names are shortened. People booking can only ever see their own place in the queue.

We do not sell personal information and do not “share” it for cross-context behavioural advertising, as those terms are defined in US state laws. We have not done so in the past 12 months.

Our service providers

Which providers are used depends on your country and the features a business turns on. We update this list before we add a new type of provider that handles booking information. If you need the name of a specific provider (for example, to exercise your rights), email contact@tokn.live and we will tell you.

Tokn’s database is hosted in Sydney, Australia. Some information is processed in other countries:

• Hosting: our websites and app are served from the United States and a global edge network, so page requests, request logs and visit statistics are processed there.
• Sign-in, maps, push notifications, WhatsApp and SMS alerts, and email: processed in the United States and other countries.
• Payments: processed in India, for Indian payments.

Providers’ support teams may also access data from other countries. The protections depend on where you are:

• Australia: we use these providers under their data processing terms, which limit how they use personal information and require them to keep it secure. We remain accountable under the Australian Privacy Principles for how they handle it.
• United Kingdom (and the EU, if it applies): where information goes to a country the UK hasn’t approved as adequate, we rely on the safeguards in our providers’ data processing terms: the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU–US Data Privacy Framework where a provider is certified. You can ask us for a copy of the relevant safeguards.
• India: the Digital Personal Data Protection Act 2023 and its Rules allow transfers outside India except where the Government of India restricts them. No country is restricted today. If one is, we will stop sending personal data there.
• United States: our providers are bound by contract to protect the information and use it only for us, as US state privacy laws require of service providers.

Neither tokn.live nor app.tokn.live uses advertising or tracking cookies, third-party tracking pixels, or cross-site tracking. That is why we don’t show a cookie banner: there is nothing optional to ask about.

• Strictly necessary storage (app.tokn.live and business booking pages): cookies and browser storage that keep you signed in, remember a booking in progress and your settings, keep the service secure, and (if you turn them on) deliver push notifications. They don’t need consent under Australian, Indian, UK or US rules. If you block them, sign-in and booking won’t work.
• Visit statistics (cookieless): counted as described in section 3, without cookies or anything stored on your device. We don’t load the statistics script at all if your browser sends a Global Privacy Control or Do Not Track signal, or if you opt out below.
• Third-party content: maps on some pages come from Google, and online payment pages come from the payment processor. These may set their own cookies, needed for the service and for fraud prevention, under their own privacy policies.

The choice above applies to tokn.live in this browser. To opt out everywhere, including app.tokn.live, turn on Global Privacy Control in your browser. We honour Global Privacy Control and Do Not Track signals, although we don’t sell or share personal information in the first place. If we ever add optional cookies or trackers, we will ask for your consent before using them and update this section first.

We protect personal information with measures that match its sensitivity, including:

• Encryption in transit (HTTPS/TLS) and encryption at rest by our hosting providers.
• Row-level access controls, so each business and each person can reach only their own records.
• Least-privilege staff access, separate keys for server functions, and restricted API keys.
• Minimal collection, shortened names on shared screens, and scheduled deletion of old data.

No system is completely secure. If a data breach is likely to cause serious harm, we will contain it, assess it promptly, and notify affected people and regulators as the law requires. That includes notifying the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme; the UK Information Commissioner’s Office within 72 hours; and the Data Protection Board of India and affected people in India without delay, with a full report to the Board within 72 hours. Where we act for a business, we will tell that business without undue delay so it can meet its own obligations.

• Live queue data: deleted automatically after 30 days.
• Bookings, payments records and ratings: kept for up to 3 years so businesses have their booking history, then deleted or moved to a restricted archive used only for legal, tax and dispute purposes.
• Tokn and business accounts: kept while the account is open. After you ask us to close it, we delete or de-identify account information within 30 days, except records we must keep by law (for example tax records, usually 5 to 7 years).
• Technical and security logs: kept for a limited period, normally no more than 90 days, unless needed to investigate an incident or a longer period is required by law (for example, Indian law may require some logs to be kept for up to a year).
• Business contact information used for outreach: deleted when you ask. We also review it at least once a year and delete contacts who haven’t responded in 24 months, except a minimal suppression record that keeps you off our lists.

A business may ask us to delete its booking records sooner. When we no longer need personal information, we securely delete it or de-identify it. Where Indian law requires, we will tell you before we erase your data because you have stopped using Tokn, so you can keep using it if you wish.

Depending on where you live, you may have the right to:

• know what personal information we hold about you, and get a copy;
• correct, complete or update it;
• delete it;
• receive it in a portable, machine-readable format;
• object to, or ask us to restrict, how we use it, including for direct marketing (always honoured);
• withdraw consent at any time;
• opt out of the sale or sharing of personal information and of targeted advertising (we don’t do either);
• nominate someone to exercise your rights if you die or become incapacitated (India);
• use a registered consent manager to give, manage or withdraw consent (India);
• complain to us, and to a privacy regulator (see section 17).

To make a request, email contact@tokn.live from the email address or mobile number linked to your booking or account, or tell us how to reach you. We may need to verify your identity before acting. An authorised agent can make a request for you with your written permission. Requests are free. We respond within 30 days (45 days for US state law requests), or within any shorter period required by law, and tell you if we need longer (up to the legal maximum) and why. If we refuse a request, we explain why and how to complain or appeal. We will never discriminate against you for exercising your rights.

If your request concerns a booking, we may pass it to the business you booked with, as it controls that information. We will help it respond.

Australia

We handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. That includes the rules on collection notices, direct marketing and cross-border disclosure (APPs 5, 7 and 8), transparency about automated decisions (APP 1, see section 5), and your rights to access and correction (APPs 12 and 13). You can also deal with us anonymously or using a pseudonym where that’s practical (APP 2). If you’re not satisfied with our response to a complaint, you can contact the OAIC.

United Kingdom

Tokn offers its service to businesses and their clients in the United Kingdom. Where the UK GDPR applies, this policy sets out our legal bases (section 5), international transfers (section 8) and your rights (section 12). Please complain to us first at contact@tokn.live: we acknowledge complaints within 30 days and tell you the outcome without undue delay. You can also complain to the Information Commissioner’s Office (ico.org.uk). Tokn does not currently offer its service in the EU or EEA. If you are there, you have the same rights under the EU GDPR, and you can complain to your local data protection authority.

India

Under the Digital Personal Data Protection Act 2023 and the Digital Personal Data Protection Rules 2025, you can access a summary of your personal data and how it is processed, correct, complete, update and erase it, withdraw consent as easily as you gave it, nominate another person to act for you, and seek grievance redressal. When a business uses Tokn, that business is the data fiduciary and Tokn is its data processor. For our own accounts and websites, Tokn is the data fiduciary. Grievances go to our Grievance Officer at contact@tokn.live, and we respond within 30 days. If you’re not satisfied, you may complain to the Data Protection Board of India.

United States (including California)

In the past 12 months we have collected these categories of personal information:

• identifiers (name, mobile number, email, IP address);
• commercial information (bookings and subscriptions);
• internet activity (logs and cookieless visit statistics);
• approximate or precise geolocation, only with permission;
• professional information (for business contacts).

The sources, purposes, recipients and how long we keep each category are described in sections 3, 5, 7 and 11. We disclose these categories to the businesses you book with and to our service providers, for business purposes only. We do not sell or share personal information, or use it for targeted advertising or profiling. We use sensitive personal information (precise geolocation, and the fact of a booking with a health provider) only to provide the service you asked for, never to infer characteristics. Residents of California and of other states with comprehensive privacy laws (including Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia) can exercise the rights in section 12, and appeal a refused request by replying to our decision. If we refuse your appeal, we will tell you how to contact your state attorney general.

New Zealand

We handle personal information consistently with the Information Privacy Principles in the Privacy Act 2020. You can complain to the Office of the Privacy Commissioner (privacy.org.nz).

Other countries

If you live somewhere else, you may have similar rights under local law. Email contact@tokn.live and we will honour them as required.

Tokn accounts are for adults. Children under 16 (under 18 in India, where a parent’s verifiable consent is required) should not create an account or make a booking themselves. A parent or guardian may book on a child’s behalf and gives only the child’s name for that booking. We don’t knowingly collect more information about children, don’t track them, and don’t target them with marketing. If you think a child has given us personal information, email contact@tokn.live and we will delete it.

Businesses using Tokn are responsible for their own privacy obligations to their customers. That includes having a lawful basis to collect booking information and giving any notices their own laws require, such as a collection notice for health services. Tokn processes booking information only on the business’s instructions and keeps it confidential and secure. We help businesses respond to access, correction and deletion requests, and notify them of relevant data breaches. A data processing agreement is available on request at contact@tokn.live.

We will update this policy when our practices or the law change, and show the new date at the top. If a change is significant, we will tell business account holders by email, and people with a Tokn account in the app, before it takes effect. If the law requires it, we will ask for your consent again.

For any privacy question, request or complaint, contact our Privacy and Grievance Officer at contact@tokn.live. Please give enough detail for us to understand the issue. We acknowledge complaints promptly and aim to resolve them within 30 days.

If you’re not satisfied with our response, you can contact a regulator:

• Australia: Office of the Australian Information Commissioner, oaic.gov.au, 1300 363 992
• United Kingdom: Information Commissioner’s Office, ico.org.uk
• India: Data Protection Board of India
• New Zealand: Office of the Privacy Commissioner, privacy.org.nz
• United States: your state attorney general or privacy agency (for California, the California Privacy Protection Agency, cppa.ca.gov)
• European Union and EEA: your local data protection authority (edpb.europa.eu lists them)