Privacy Policy

Effective Date: August 10, 2026

TOLACARD ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, share, and protect your personal information when you use the TOLACARD platform, including our mobile application, website, and all related services (collectively, the "Platform").

1. Information You Provide

  • **Account Information:** Name, mobile number, email, username, and profile photo
  • **Payment Information:** Processed securely by Stripe; we never store full card numbers
  • **Profile & Social:** Optional details like your Instagram or TikTok handle, occupation, and city
  • **Content:** Posts, photos, videos, messages, team pages, and comments you create
  • **Bookings & Purchases:** Classes you book, events you attend, credits you buy, gifts you send
  • **Membership Applications:** Details you submit when applying for a membership (name, contact information, company, business details such as deals closed and sales volume, and an optional photo). Submitting an application creates a TOLACARD account using these details; you sign in with a one-time code to the mobile number you applied with.
  • **Communications:** Messages to the concierge, support requests, and applications you submit

    • 2. Information Collected Automatically

  • **Location Data:** With your permission — to show nearby locations on the map, power check-ins, and (where ride features are used) provide routing. You can withdraw location permission in device settings.
  • **Contacts:** If you use invite or call features, your device contacts are accessed on your device so you can pick someone; we store only the people you actually invite, never your whole address book.
  • **Voice:** Dictation uses your device's speech recognition. We receive the resulting text, not stored recordings.
  • **Device & Usage Data:** Device type, operating system, app version, features used, timestamps, and error logs
  • **Log Data:** IP address and browser type

    • 3. Health & Fitness Data

    If you choose to connect health services, we handle that data with extra care:

  • **Connected services (Whoop, Strava):** With your explicit authorization, we receive summaries such as recovery, strain, sleep, workouts, and activity distance.
  • **Apple Health:** With your permission, the app reads steps, workouts, calories, and heart rate on your device. Only compact daily and weekly summaries are sent to our servers — raw health samples never leave your phone.
  • **How we use it:** To show you your own numbers in the app, personalize concierge suggestions and class recommendations, and power optional social features that you control.
  • **What we never do:** We never sell health data, never use it for advertising, never share it with data brokers, and never show it to other members without an explicit action by you.
  • **Your control:** Disconnect any service at any time in Settings → Connected apps (for Apple Health, also in iOS Settings → Health → Data Access). On disconnect, or on request, we delete the stored summaries.

    • 4. AI Processing

  • The concierge and AI features send your messages, and any content you attach to them, to our AI providers (such as Anthropic, OpenAI, and Google) to generate responses.
  • If you connect apps or health services, relevant summaries may be included in AI context to personalize answers for you.
  • If you connect your own AI assistant (such as Claude or ChatGPT) to TOLACARD, the data that assistant requests is governed by that provider's terms as well as ours.
  • Avoid sharing sensitive information in chat that you would not want processed by an AI service.

    • 5. How We Use Your Information

    We use the information we collect to:

  • Create and manage your account and membership
  • Process credit purchases, bookings, gifts, payouts, and other payments
  • Operate classes, events, check-ins, and partner locations
  • Power the AI concierge and personalize your experience
  • Connect you with other members through features you choose to use
  • Send service notifications and, with consent, marketing you can opt out of
  • Improve safety, reliability, and performance
  • Comply with legal obligations and prevent fraud

    • 6. Sharing Your Information

    We do not sell your personal information. We share data only:

  • **With partner locations:** When you book a class or check in, the partner sees your name, photo, and booking details for their roster
  • **With other members:** Only what you choose to make visible — your profile, posts, and features you actively use
  • **On public pages:** If you upload a photo with a membership application, it may be shown alongside other recent applicants on public pages of the Platform, as disclosed at the point of upload. You can ask us to remove it at any time at tolacard.com/support.
  • **With service providers:** Stripe (payments, identity verification, payouts), Mapbox (maps), Twilio (verification texts), our AI providers (Section 4), push notification services (Apple, Google), and cloud infrastructure that runs the Platform, all bound by confidentiality
  • **With services you connect:** If you link Google Calendar, Instagram, Whoop, Strava, or similar, data flows as you authorize and can be revoked in Settings → Connected apps
  • **For legal compliance:** When required by law, court order, or to protect the rights and safety of our users or the public
  • **Business transfers:** In a merger, acquisition, or sale of assets, information may transfer with appropriate notice

    • 7. Data Retention

    We retain personal information while your account is active or as needed to provide services. Transaction records are retained for a minimum of 3 years for legal and accounting purposes. Health data summaries are deleted when you disconnect the service or on request.

    8. Your Rights

    Depending on your location, you may have the right to:

  • Access the personal information we hold about you
  • Correct inaccurate or incomplete information
  • Delete your account and personal data (available in app settings)
  • Opt out of marketing communications
  • Withdraw location, contacts, or health permissions in device settings

    • To exercise these rights, submit a request at tolacard.com/support.

    9. Data Security

    We use industry-standard security measures including encryption in transit (TLS), encrypted storage, and access controls. No system is completely secure; notify us immediately of any suspected unauthorized access.

    10. Children's Privacy

    The Platform is not intended for users under 18. We do not knowingly collect personal information from minors and will delete any such accounts we become aware of.

    11. Third-Party Links

    The Platform may link to third-party sites and services. We are not responsible for their privacy practices; review their policies.

    12. Changes to This Policy

    We may update this Privacy Policy from time to time. We will notify you of material changes via the app or email at least 14 days before they take effect. Continued use of the Platform after changes constitutes acceptance.

    13. Contact Us

    Questions about this Privacy Policy or your personal data:

    TOLACARD

    tolacard.com/support