Privacy Policy
Last updated 1 October 2026
This explains what personal information Ma Katrina Estrella Padilla, trading as Deskarti (ABN 32 276 237 390), collects through Toka, why, and who it goes to. Toka is based in Australia and follows the Australian Privacy Principles.
Who this is about
A merchant is a business that signs in to Toka to collect an invoice. A payer is someone asked to pay part of one. A contributor is someone a payer invites to help pay their share. Payers and contributors never create an account — a link carries a token that expires after 30 days and can be revoked, and that is the only credential involved.
What we collect
From merchants: your email address and sign-in credentials, your business name, and encrypted access tokens for the providers you connect.
About payers and contributors, entered by the merchant or by whoever splits the invoice: name, email address, sometimes a mobile number, the amount each person is responsible for and whether it has been paid, and the invoice it belongs to.
Automatically: the IP address and browser your sign-in session came from, the messages our payment provider sends us about each payment, and a record of what happened to money and when.
Cookies. Two, both functional: one keeps you signed in, one remembers whether you collapsed the sidebar. No analytics, no advertising, no third-party tags anywhere in Toka.
What we never collect
Card numbers and bank account details never reach Toka. They go straight to our payment provider, either on a page they serve or through their script in your own browser. We only ever hold a reference to the payment. We could not show you a card number if you asked us to.
Toka never holds your money. Payment goes from the payer to the merchant through the payment provider. Toka has no balance, no float and no custody of funds at any point — it records that the payment happened.
Why we collect it
To show each payer what they owe, to record payments as they settle, to write settled payments back to your accounting system, and to keep an accurate history of what happened to money. We do not use it for anything else.
We send no marketing. The only emails Toka sends are password resets and replies to the contact form, so there is nothing to unsubscribe from.
Who it goes to
Only these, and only to do the job you asked for:
- Pinch Payments — payer name, email and amount, to take the payment
- Xero or QuickBooks — the payments we record, written back against your invoice, if you connect one
- Resend — contact form messages and password-reset emails. Nothing about a payer or a payment
- Railway — hosts the application and its database
Some of these providers operate outside Australia and may store or access information overseas. We do not sell personal information and we do not share it for advertising.
How long we keep it
Payment links expire after 30 days and stop working. Sign-in sessions end when they expire or you sign out.
Records of money that has moved — invoices, shares and payments — are kept for five years, which matches the period the ATO requires business records to be kept. Everything else is deleted or de-identified within a reasonable time of your account closing, or sooner if you ask and we are not required to keep it.
Getting at it, correcting it, complaining
Ask us what we hold about you, ask us to correct it, or ask us to delete it where we are not required to keep it. Email hello@letstoka.com. If a merchant asked you to pay, we will also tell you who they are so you can go to them directly.
If something has gone wrong, tell us at the same address. We will acknowledge it within 5 business days and answer within 30 days. If you are not happy with our answer you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or 1300 363 992.
Security
Provider credentials are encrypted before they are stored. Payment links are stored as hashes, so a copy of our database does not yield a working link. Each merchant’s data is reachable only by that merchant, and that is enforced by automated tests rather than by convention. If a breach happens that is likely to cause you serious harm, we will tell you and the Information Commissioner.
Changes and contact
If this changes we will update the date at the top. Contact: hello@letstoka.com.