Privacy Policy

1. Data Controller

The data controller is PinStudio, for the TokRouter project, based in Switzerland. Address: Route de la Crête Blanche 28A Granges 3977, Switzerland.

Contact: contact@mattok.ch

2. Data Collected

• Account data : name, email address, password (hashed).
• Payment data : processed exclusively by Stripe. TokRouter does not store any credit card numbers.
• Usage data : AI conversations, API requests, credit consumption logs, models used.
• Technical data : IP address, browser type, pages viewed, session duration.

3. Purposes and Legal Bases

4. Data Retention

• Account data: duration of the contractual relationship + 3 years.
• Conversations and API logs: 12 months after last activity.
• Billing data: 10 years (legal obligation).
• Technical logs: 6 months.

5. Your Rights (GDPR)

In accordance with the General Data Protection Regulation (GDPR), you have the following rights:

• Right of access: obtain confirmation that your data is processed and receive a copy.
• Right of rectification: correct inaccurate or incomplete data.
• Right to erasure ("right to be forgotten"): request deletion of your data.
• Right to restriction: restrict processing in certain cases.
• Right to portability: receive your data in a structured format and transmit it to another controller.
• Right to object: object to the processing of your data for legitimate reasons.
• Right to withdraw consent: at any time, without affecting the lawfulness of prior processing.
• Right to define post-mortem directives: regarding the fate of your data after your death.

The right to erasure can be exercised directly from Settings → Danger zone (reversible for 14 days). For other rights, contact us at contact@mattok.ch. A response will be provided within one month.

6. Cookies

TokRouter uses only strictly necessary technical cookies for service operation: session cookie (authentication) and language preference cookie. No advertising or tracking cookies are placed. In accordance with the ePrivacy Directive, these cookies do not require prior consent.

7. Third-Party Processors

• Stripe, Inc. — payment processing (PCI DSS Level 1 certified).
• AI model processing provider — transmission of requests to AI models for processing.
• Hosting provider — hosting infrastructure located within the European Union.

European Commission Standard Contractual Clauses (SCCs) govern any data transfers outside the EU.

8. Security

TokRouter implements appropriate technical and organizational measures to protect your data: TLS encryption in transit, password hashing (bcrypt), restricted data access, continuous monitoring. In case of a high-risk data breach, we will notify you and the relevant supervisory authority within 72 hours.

9. Right to Complain

If you believe your data processing does not comply with regulations, you may lodge a complaint with your local data protection supervisory authority. In France: CNIL — www.cnil.fr.