LEGAL · DPDP ACT 2023
Privacy Policy
Effective from 23 July 2026.
Who we are
Toknly is a product of Pinnacle Consultancy Group, an entity registered in India with its office at 3-3-110/VF/301, Pleasant Park Colony, Hyderabad — 500048. For the purposes of India's Digital Personal Data Protection Act, 2023 (“DPDP Act”), Pinnacle Consultancy Group is the Data Fiduciary in respect of personal data collected through the Toknly service and website at toknly.in.
What we collect
- Account data: your name, email address and a bcrypt-hashed password (we never store your plaintext password).
- Provider API keys you paste during onboarding — stored encrypted at rest with a symmetric key we manage.
- Usage entries you log or import (provider, model, tokens, cost, date and optional project tag).
- Budget preferences and notification settings (Slack webhook URL, weekly-digest opt-in).
- Analytics telemetry: anonymised page views, click events and session replays via PostHog. IP addresses are truncated at collection.
- Server logs: IP, user-agent and timestamp of API calls, kept 30 days for security and abuse-prevention.
Why we process it
We process the categories above only to (a) provide and secure the Toknly service, (b) render your personalised dashboards and alerts, (c) send transactional emails you've consented to (budget alerts, digests, password reset, team invites), (d) diagnose errors, and (e) comply with legal obligations. We do not sell or rent personal data to third parties, and we do not use your usage data to train models.
Your rights under the DPDP Act
As a Data Principal you have the right to:
- Access a summary of your personal data being processed;
- Request correction, completion, updating and erasure of your data;
- Withdraw consent at any time (your account will be deactivated on withdrawal);
- Nominate another individual to exercise your rights in the event of death or incapacity;
- Escalate a grievance to our Grievance Officer, and thereafter to the Data Protection Board of India.
Grievance Officer
You may reach our Grievance Officer at info@toknly.in. We respond to DPDP Act requests within thirty (30) days.
Pinnacle Consultancy Group
3-3-110/VF/301, Pleasant Park Colony
Hyderabad — 500048, India
Pinnacle Consultancy Group
3-3-110/VF/301, Pleasant Park Colony
Hyderabad — 500048, India
Retention
We retain account data for as long as your account is active. On deletion, personal identifiers (name, email, provider keys) are permanently removed within 30 days; aggregated, anonymised statistics may be retained for product analytics. Server logs are purged after 30 days.
Security & breach notification
We use bcrypt for password hashing, Fernet symmetric encryption for stored API keys, HTTPS in transit and principle-of-least-privilege access controls. In the unlikely event of a personal-data breach that is likely to result in harm, we will notify you and the Data Protection Board of India as required by the DPDP Act.
Cross-border transfers
Toknly's infrastructure and sub-processors (OpenAI TTS via Emergent, Resend for transactional email, PostHog for analytics, MongoDB Atlas for storage) may be located outside India. We only transfer personal data to jurisdictions permitted under Section 16 of the DPDP Act and rely on contractual safeguards with each processor.
Cookies
We use two strictly-necessary, first-party HTTP cookies (
access_token and refresh_token) to keep you signed in. Both are HttpOnly, Secure and SameSite=None. We do not set third-party marketing cookies.Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be announced by email to the address on file at least 14 days before they take effect.
This document is provided in good faith for compliance with the DPDP Act, 2023. It is not a substitute for independent legal advice. If you have questions, contact info@toknly.in.