Privacy Policy

This Privacy Policy explains what personal information PROTOTOKOS, LLC (“PROTOTOKOS,” “we,” “us”) collects when you use prototokos.com, how we use it, who we share it with, and the rights you have over it. By using the site you agree to the practices described below.

1. What we collect

We collect the following categories of information:

• Order and contact information: name, shipping and billing address, email address, phone number (if provided), order contents.
• Payment information: payment card details are collected and processed directly by Stripe, Inc. We do not store full card numbers on our servers; we receive only a payment token and the last four digits for receipts and customer support.
• Account information: if you create an account, our authentication partner (Clerk) stores your email, password hash, and basic profile metadata. We receive a user ID and email from Clerk.
• Email correspondence: messages you send to hello@prototokos.com and any transactional or marketing emails we send through Resend.
• Technical and usage data: IP address, browser type, device type, pages visited, referring URL, and timestamps. This is collected automatically through standard server logs and our hosting platform (Vercel).

2. How we use it

• To process your order, take payment, and arrange shipping.
• To send transactional emails: order confirmation, shipping updates, delivery, and post-purchase care.
• To provide customer support and respond to your questions.
• To send marketing email about new releases, only if you opted in. You can unsubscribe at any time using the link in any marketing email.
• To prevent fraud, debug technical issues, and keep the site secure.
• To meet legal, tax, and accounting obligations.

3. Who we share it with

We do not sell your personal information. We share it only with service providers who help us operate the site and fulfill your order:

• Stripe — payment processing.
• Clerk — account authentication.
• Resend — transactional and marketing email delivery.
• Supabase — database hosting for orders and accounts.
• Vercel — site hosting and serverless functions.
• Cloudflare — DNS, email routing, and image storage (R2).
• Print and fulfillment partner — receives the shipping address and order contents needed to produce and ship your piece.

Each vendor processes your data only to perform the service for which we engaged them and is bound by its own privacy and data-processing terms. We may also disclose information when required by law, valid legal process, or to protect our rights or the safety of others.

4. Cookies

We use only cookies that are essential for the site to function: keeping you signed in, remembering items in your cart, and preventing cross-site request forgery. We do not currently use third-party advertising or behavioral-tracking cookies. If we add analytics or advertising cookies in the future, we will update this policy and, where required, ask for your consent.

5. Data retention

Order records are retained for as long as needed to provide support and to comply with tax, accounting, and consumer-protection laws — typically seven years. Account data is retained while your account is active. Marketing-email subscriber data is retained until you unsubscribe. Server logs are retained by our hosting provider for a rolling period of up to 30 days.

6. Your rights

Depending on where you live, you may have the right to:

• Request a copy of the personal information we hold about you.
• Ask us to correct inaccurate information.
• Ask us to delete your information, subject to legal retention obligations.
• Opt out of marketing email at any time.
• Lodge a complaint with your local data-protection authority if you believe we have mishandled your information.

To exercise any of these rights, email hello@prototokos.com from the address on file. We respond within 30 days.

7. California residents

Under the California Consumer Privacy Act (CCPA), California residents may request disclosure of the categories of personal information we collect, the purposes for which it is used, and the categories of third parties with whom it is shared — all of which are set out in sections 1–3 above. We do not sell personal information and have not done so in the previous twelve months.

8. International users

We operate from the United States, and our service providers are located primarily in the United States and the European Union. If you access the site from outside the United States, you understand that your information will be transferred to and processed in the United States. We rely on standard contractual safeguards offered by our service providers for international transfers.

9. Children

prototokos.com is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us and we will delete it.

10. Security

We use TLS encryption in transit, vetted hosting and database providers, and limited internal access to personal information. No method of electronic storage or transmission is perfectly secure; we cannot guarantee absolute security, but we work to protect your data in line with industry practice.

11. Changes to this Policy

We may update this Privacy Policy from time to time. The “Last updated” date below indicates when the current version took effect. Material changes will be communicated by email or by a notice on the site.

12. Contact

Privacy questions can be sent to hello@prototokos.com.

Last updated: 2026-05-08.