TokenNo Privacy Policy (United States)

DRAFT. NOT YET IN FORCE. This Privacy Policy is a draft. Qualified legal counsel in the United States has not yet reviewed it, and it is not in force. It is not legal advice. Text in [square brackets] is a placeholder or a point still open for counsel. The final version will replace this draft before any customer or business uses TokenNo in the United States.

1. Who we are and what this policy covers

TokenNo ("TokenNo", "we", "us") is a queue and token platform. In the United States it is provided by [TokenNo North America entity legal name], [registered address] (contact: info@tokenno.com). This entity is the "business" under the California Consumer Privacy Act (and the controller under other state privacy laws) responsible for your personal information, and the merchant of record for advance payments. It includes:

the TokenNo customer app, which you use to book and track tokens;
the TokenNo Business app for businesses, including the web front desk and the TV "Now Serving" board;
the TokenNo admin console, which our own staff use;
our public website at tokenno.com; and
the TokenNo Integration API, which lets businesses connect their own systems.

This policy explains what personal information we collect in the United States, why we collect it, who we share it with, how long we keep it and what choices and rights you have. It applies to customers (people who book tokens, including hosts and their guests) and to people who work for businesses that use TokenNo ("vendors"), such as owners, receptionists and doctors.

Vendors include clinics, hospitals, restaurants, salons, offices and event organisers. Each vendor decides what services it offers and how it runs its own queue, and has its own privacy practices. Once a vendor moves information out of TokenNo, for example into its own clinic software or point-of-sale system through the Integration API, that vendor's privacy policy applies to it, not this one (see section 6). How responsibilities are split between TokenNo and vendors is set out in the Vendor Data Processing Addendum that vendors accept (Terms of Service, section 27).

Group companies. Staff of other TokenNo group companies, including [TokenNo India entity legal name] in India, may access personal information to operate, support and secure the service, under intra-group agreements and the safeguards in section 8 [counsel to confirm the group structure and which group companies have access, and where].

2. Notice at collection (summary)

This short summary is our notice at collection under the California Consumer Privacy Act. The details are in the sections that follow. A link to this notice is shown at or before each point of collection: the sign-up (one-time code) screen, the location-sharing prompt, the guest web view, and the first message to a number booked by a vendor or added by a host.

What we collect: your name, mobile number, language preference, bookings and token history, mobile numbers of guests you invite, your live location only while you turn on sharing for an active token, device push tokens and payment records. For vendor staff we also collect staff and business details, KYC (identity and business verification) documents and audit logs.
Why: to run the service, issue and call tokens, send booking messages, take payments and refunds, verify businesses, keep the platform secure and comply with the law.
Sale or sharing: we do not sell your personal information. We do not share it for cross-context behavioral advertising, as California law defines those terms.
Sensitive personal information: we collect (a) precise geolocation from customers, only when you choose to share it for an active token, used to show distance and ETA, send "leave now" alerts and mark you as arrived; and (b) government ID, driver's licence or passport numbers contained in KYC documents from vendor owners and authorised staff, used only to verify the business. We use sensitive personal information only for the purposes allowed by Cal. Code Regs. tit. 11 § 7027(m), and not to infer characteristics about you. [Counsel to confirm whether booking history with health care vendors is "personal information collected and analyzed concerning a consumer's health" (and so sensitive personal information), and to reflect the answer here and in section 11.2.]
How long we keep it: each category's retention period, or the criteria we use, is in section 9.
Your rights: see sections 11 and 12.

3. What we do NOT collect

We have deliberately kept the information we collect to a minimum in this first phase of TokenNo ("Phase 1").

No medical records or health details. Even when you book with a clinic, hospital or doctor, we collect only your name and mobile number together with the booking itself. We do not ask for symptoms, diagnoses, insurance details or any other health information. Please do not type health information into any free-text field.
HIPAA. TokenNo does not claim HIPAA compliance. Under HIPAA, a patient's name and phone number linked to an appointment with a covered health care provider can be protected health information, and a company that handles it for the provider can be a business associate whatever data it collects. For that reason, in Phase 1 TokenNo may not be used by HIPAA covered entities (or their business associates) for patient scheduling, and we check this when a vendor signs up. [Counsel to choose: (a) keep this Phase 1 restriction until a business associate agreement (BAA) is offered in Phase 2; or (b) offer a BAA now and update this section, the Terms and vendor onboarding.]
No card or bank account numbers. Our payment gateways handle card and bank details. TokenNo never receives or stores your full card number or security code.
No background location. We never track your location in the background, or at any time when you have not turned sharing on for an active token.

Even without health details, the fact that you booked a token with a clinic could show that you sought health care. We treat booking history with health care vendors as sensitive. We disclose it only to you, your guests, the vendor, and the service providers and vendor systems described in section 6 that need it to deliver the service. [Product to consider keeping room or specialty names out of SMS and WhatsApp text for health care vendors.] [Counsel to confirm: whether clinic booking data may be "consumer health data" under the Washington My Health My Data Act and similar state laws (for example in Nevada and Connecticut), and whether a separate consumer health data privacy policy is needed.]

4. Information we collect

4.1 Information you give us

Account information: your mobile number, which is your TokenNo identity (you sign in with a one-time code sent by SMS), your name and your language preference. One mobile number is one identity across TokenNo. The same number can be used both as a customer and as vendor staff.
Bookings and tokens: the vendor, location, service point (for example a doctor or a counter), session, token number, party size, booking status (booked, called, served, cancelled, no-show, renumbered) and your booking history.
Guest information: if you are a host and invite guests to share your token, the guests' mobile numbers that you enter. Please invite only people who expect to hear from you, and only if you are allowed to share their number (see section 5.3).
"Notify me" requests: the vendors or sessions for which you asked to be told when booking opens.
Messages to us: what you send when you contact support.

4.2 Information collected automatically

Live location, only when you turn it on: if you choose to share your location for an active token, we collect your device's precise location while sharing is on. We use it to show your distance and estimated arrival time to you, your host or guests and the vendor, to send a "leave now" alert, and to mark you as "arrived" automatically when you come within about 100 m of the location (geofence arrival). Sharing stops automatically (for example when the token is served or cancelled) and you can stop it at any time. We delete location data soon after the visit (see section 9).
Device and app information: push notification tokens (via Firebase Cloud Messaging), device type, operating system, app version and the language setting.
Security and usage logs: sign-in events, IP address, timestamps and actions taken in the apps and the admin console (audit logs). We use these to keep the platform secure and to resolve disputes.
Website cookies: our website uses cookies and similar technologies that it needs to work. [Placeholder: list any analytics cookies before launch. If analytics or advertising cookies are added, this policy and the "sale/sharing" statements must be reviewed.]

4.3 Information from vendors and others

Bookings made for you by a vendor: a vendor may book a token for you, for example when you phone the front desk, walk in, or use its QR code or kiosk, or through its own system connected to the Integration API. In that case the vendor gives us your mobile number, and sometimes your name (see section 5.3).
Payment information from our payment gateways: whether the payment succeeded, the amount, a masked card reference (for example the last four digits), transaction identifiers and refund status.
Messaging providers: message delivery status, and replies such as STOP or HELP.

4.4 Information about vendor staff and businesses

staff names, mobile numbers, roles and the locations they can access;
business details (legal name, address, contacts, business type, locations and service points);
KYC documents, such as government ID, business registration and tax identification documents, and the results of verification checks;
payout and banking details. These are held mainly by our payment gateway, and we may keep a masked reference;
API keys (we store only a secure hash of each key), webhook settings and API call logs.

5. How we use information

We use personal information to:

Provide the service: create your account, issue tokens, show the live queue, call your token, handle renumbering ("push back") and cancellations, and let hosts and guests share one token.
Send service messages: booking confirmations, "your token is being called" alerts, changes (including new token numbers), cancellations (including when a vendor or a location holiday cancels a session) and "notify me when booking opens" alerts. We send these by push notification, SMS and WhatsApp.
Use your location: only while you share it for an active token, to show distance and ETA, send "leave now" alerts and mark you as arrived by geofence. [Counsel to decide, before launch, whether geofence arrival must be off for health care vendors in Washington and Nevada (and under Connecticut's equivalent rules), given the bans on geofencing around in-person health care providers in Washington's My Health My Data Act (RCW 19.373.080) and Nevada SB 370.]
Take payments and make refunds: when a vendor requires advance payment, we collect it as merchant of record, apply the vendor's refund rule and pay vendors out.
Verify businesses: review vendor KYC documents before approving a vendor.
Keep TokenNo safe: prevent fraud and misuse, secure accounts and keep audit logs.
Translate vendor content: show business names, descriptions and room names in your chosen language. Vendor content, not your personal information, is what gets translated.
Improve the service: for example, estimate service times per service point using booking timing data, in aggregated or de-identified form where possible.
Comply with law: meet legal, tax, accounting and law-enforcement obligations, and enforce our Terms of Service.

5.1 Marketing

We do not use your information to send marketing messages unless you agree to receive them. If we ever send marketing emails, they will follow the CAN-SPAM Act. They will identify us, include our postal address and include a working unsubscribe link, which we will honor promptly. We will send marketing texts or automated marketing calls only with your prior express written consent, as the Telephone Consumer Protection Act (TCPA) requires. Agreeing to marketing is never a condition of using TokenNo.

5.2 SMS and WhatsApp messages

TokenNo booking alerts is our SMS program. When you sign up with your mobile number and accept our Terms of Service and this Privacy Policy, you agree that we may send you texts and WhatsApp messages about your bookings and your account (one-time sign-in codes, confirmations, calls, changes and cancellations). Message frequency depends on your bookings. Message and data rates may apply.

If a vendor or host enters your number, see section 5.3.

We do not share or sell your mobile number or SMS opt-in data with third parties or affiliates for their marketing purposes. It is shared only with providers that send messages for us.
Reply STOP to any TokenNo SMS to stop receiving texts. Reply HELP for help, or email info@tokenno.com.
You can also withdraw consent in any other reasonable way, for example by telling us by email. [Counsel to confirm: current FCC rules on revoking consent by "any reasonable means" and their effective dates.]
If you reply STOP, texts from us stop, including sign-in codes. Reply START to receive them again, or sign in with [WhatsApp / another method]. You may still receive push notifications in the app. Without SMS you may miss "your token is being called" alerts. [Product to confirm this wording against the SMS provider's opt-out behaviour.]
WhatsApp messages are sent through the Meta WhatsApp Business platform and follow Meta's opt-in and opt-out rules. You can block or opt out in WhatsApp at any time.
Carriers are not liable for delayed or undelivered messages.

5.3 Numbers entered by a host or vendor

When a host invites a guest, or a vendor books a token for a caller or walk-in, we did not get the number from that person. We rely on the host's or vendor's confirmation that the person agreed to service messages about that visit (Terms of Service, sections 17 and 27). We use the number only to tell the person about that token (for example the token number, changes, calls and cancellations), and we never send marketing to these numbers.

The first message to any number entered by someone else identifies TokenNo and who added the number, says it is a service message about one visit, and includes "Reply STOP to opt out, HELP for help. Msg & data rates may apply." The person can also contact us to ask us to delete their number. [Counsel to confirm: TCPA consent position for messages to numbers supplied by a host or vendor.]

6. How we share information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We share it only as follows:

With the vendor you book with: your name, mobile number, token, party size, booking status, payment and refund status and, while you share location, your distance and ETA. The vendor uses this to serve you. Each vendor is responsible for its own use of this information. [Product to confirm that vendors never see raw coordinates; if an option to show them is added, it will be disclosed here and need your opt-in.]
With your host or guests: the token details and status, and, while sharing is on, the distance and ETA you chose to share.
With a vendor's own systems (Integration API): if a vendor connects its own systems (for example clinic software or a POS) to TokenNo, the customer's name, mobile number and booking, token and payment event data for that vendor (for example token number, status, session and payment succeeded events) are sent to those systems on the vendor's instruction. Health details are never sent. Once it arrives, the vendor is responsible for it.
With service providers (sub-processors) that work on our behalf under contracts limiting their use of your information:
- Amazon Web Services (AWS): hosting and storage;
- payment gateways: Stripe for the United States; Razorpay, Tap Payments and Moyasar serve other TokenNo markets;
- SMS and WhatsApp providers: Twilio, MSG91, Unifonic and Meta WhatsApp Business (the provider depends on the country);
- Google Firebase Cloud Messaging: push notifications;
- translation providers: vendor content only;
- maps and routing providers: we send location coordinates to them to calculate distance and ETA.
A current list of sub-processors is available from info@tokenno.com [placeholder: or at a sub-processor page URL].
For legal reasons: to comply with law, a court order or a valid legal request; to protect the rights, safety and property of users, vendors, TokenNo or the public; or to enforce our terms.
In a business transfer: as part of a merger, acquisition, financing or sale of assets. The recipient will remain bound by this policy, or we will notify you.
With your consent or at your direction.

7. Where your information is stored (cross-border transfer)

TokenNo is hosted on AWS, and our servers are currently in the AWS Mumbai region, India. If you use TokenNo in the United States, your information will be transferred to, stored in and processed in India. Some of our service providers may also process it in the United States or other countries. Privacy laws in those countries may differ from those in your state. We protect your information wherever it is processed, using the safeguards in section 8 and contracts with our providers. [Counsel to confirm: whether any federal or state rule on transferring US personal data abroad requires further steps for hosting in India.]

8. How we protect information

We use reasonable administrative, technical and physical safeguards, including:

encryption in transit, and encryption at rest where available;
role-based access, with audit logs of actions in the vendor apps and the admin console;
one-time-code sign-in;
API keys that are shown only once and stored only as a secure hash, with scopes, IP allowlists and revocation;
webhooks signed so they can be verified; and
data minimisation: the only personal details we ask customers for are name and mobile number; we also process the booking, device, log, payment and (optional) location data described in section 4.

No system is perfectly secure. If a data breach affects your personal information, we will notify you and the relevant authorities as the applicable state data breach notification laws require, and without unreasonable delay. [Counsel to confirm: whether the FTC Health Breach Notification Rule could apply to any TokenNo feature.]

9. How long we keep information

We keep personal information only as long as we need it for the purposes in this policy, or as long as the law requires. [Launch blocker: every [X] period below must be filled in, or replaced with the criteria used, before this policy is published, because the CCPA notice at collection relies on it.]

Live location: deleted within [X hours] after the token is served, cancelled or expires. Sharing stops automatically before that.
Account information: while your account is active, and for [X months] after you delete it or after [X months] of inactivity.
Bookings and token history: [X months/years], so you can see past bookings and use "Book again", and so disputes can be resolved.
Guest mobile numbers: [X days] after the shared booking ends, unless the guest has their own TokenNo account.
Payment and refund records: as long as tax, accounting and payment-network rules require [placeholder: for example 7 years; counsel to confirm].
Vendor KYC documents: for the length of the vendor relationship plus [X years], or longer if the law requires it.
Audit and security logs: [X months/years].
Push tokens: until you sign out, uninstall the app or the token expires.

When we no longer need information, we delete it or de-identify it.

10. Children

TokenNo is not directed to children under 13, and we do not knowingly collect personal information from children under 13. This is in line with the Children's Online Privacy Protection Act (COPPA). You must be at least [18] years old, or the age of majority where you live, to create a TokenNo account. [Counsel to confirm minimum age.] A parent or guardian may book a token for a visit that includes a child, using the parent's own account. If you believe a child under 13 has given us personal information, contact info@tokenno.com and we will delete it.

11. Your privacy rights

11.1 Rights for everyone

Wherever you live in the United States, you can:

see and update your name and language preference in the app (Profile);
stop location sharing at any time;
stop SMS by replying STOP, opt out on WhatsApp, and turn off push notifications in your device settings; and
ask us to delete your account and associated personal information, in the app (Profile, then Delete account) or by email to info@tokenno.com.

11.2 California residents (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (Cal. Civ. Code § 1798.100 and following sections), gives you the right to:

Know and access the categories and specific pieces of personal information we have collected about you, the categories of sources, the purposes and the categories of third parties we disclose it to;
Delete personal information we collected from you, subject to legal exceptions;
Correct inaccurate personal information;
Opt out of sale or sharing. We do not sell or share personal information, so there is nothing to opt out of, but you may still submit a request;
Limit the use of sensitive personal information. We use precise location only to provide the service you request, which is a use California law permits. [Counsel to confirm that no "Limit the Use of My Sensitive Personal Information" link is required.]
Not be discriminated against for exercising your rights.

Categories of personal information collected in the last 12 months, with California's category names:

Identifiers: name, mobile number, device push token, IP address, account ID.
Customer records: name and mobile number. For vendor staff: business contact details and KYC documents.
Commercial information: bookings, tokens, payments and refunds.
Internet or other electronic network activity: app and security logs.
Geolocation data: precise location, only while you share it for an active token.
Professional or employment-related information: for vendor staff, role and business details.
Sensitive personal information: precise geolocation (as above). For vendor staff, government ID numbers in KYC documents, used only for verification.

Categories disclosed, by recipient (for a business purpose; none sold or shared):

Vendors you book with, and their connected systems: identifiers, customer records, commercial information and, while you share it, distance and ETA derived from geolocation.
Your host or guests: identifiers (name), booking status and, while you share it, distance and ETA.
Hosting (AWS): all categories.
Payment gateways: identifiers and commercial information.
SMS, WhatsApp and push providers: identifiers (mobile number, push token) and message content about your booking.
Maps and routing providers: precise geolocation, only while you share it.
Verification providers: vendor staff identifiers and KYC documents.

Sources: you, the vendors you book with, hosts who invite you, our payment gateways and messaging providers, and your device.

Purposes: those listed in section 5.

Disclosures for a business purpose: to the categories of recipients listed above and in section 6. We have not sold or shared personal information in the last 12 months. We have no actual knowledge of selling or sharing personal information of consumers under 16.

Do Not Sell or Share / Global Privacy Control. We do not sell or share personal information. We treat a Global Privacy Control (GPC) browser signal as a valid opt-out request for the browser or device that sends it. [Placeholder: the "Your Privacy Choices" link on the website and in the app.]

Shine the Light. California's "Shine the Light" law (Cal. Civ. Code § 1798.83) lets California residents ask whether we disclosed personal information to third parties for their direct marketing. We do not.

Do Not Track. Some browsers send "Do Not Track" signals. Because there is no common standard for these signals, our website does not respond to them, but we honor GPC as described above.

[Counsel to confirm: whether TokenNo meets the CCPA thresholds for a "business" at launch. These rights are offered either way.]

11.3 Residents of other states

Many states have their own consumer privacy laws, for example Virginia (Consumer Data Protection Act), Colorado (Colorado Privacy Act), Connecticut (Connecticut Data Privacy Act) and Texas (Texas Data Privacy and Security Act), as well as other states with similar laws. Depending on where you live and whether the law applies to us, you may have the right to:

confirm whether we process your personal data, and access it;
correct inaccuracies;
delete your personal data;
get a portable copy of it;
opt out of targeted advertising, sale of personal data and profiling with legal or similarly significant effects. We do not do any of these; and
appeal if we decline your request (see section 12).

We collect precise location only after you turn on sharing, which is how we obtain your consent to process this "sensitive data" where state law requires consent. We will offer the rights in this section to all US users, even where a state law does not strictly apply to us. [Counsel to confirm: list of state laws in force at launch, and any state-specific notice items.]

11.4 Information about you held by vendors

If you want to exercise rights over information a vendor holds in its own systems, or decides how to use, please also contact that vendor directly. Where we hold information on a vendor's behalf, we may pass your request to the vendor and help them respond.

12. How to exercise your rights

In the app: Profile, then Privacy (access, correction, deletion).
By email: info@tokenno.com, with the subject "Privacy request", from or mentioning the mobile number on your account.

[Counsel to confirm: whether email and in-app methods are enough, or whether a toll-free number is also required.]

Verification. To protect you, we verify requests, usually by sending a one-time code to your mobile number. We may ask for more information for requests about sensitive data.

Authorized agents. You may use an authorized agent. We may ask for proof that the agent is authorized, and ask you to verify your identity directly.

Timing. We will confirm that we received your request within 10 business days and tell you how we will process it. We will respond within 45 days, or within any shorter period your state's law requires. Where the law allows, we may extend this once, and we will tell you if we do.

Appeals. If we decline your request, you can appeal by replying to our decision or emailing info@tokenno.com with the subject "Privacy appeal". Our Privacy Officer will review your appeal and respond within the period required by your state's law. If you are not satisfied, you may contact your state's Attorney General.

We will not charge you, deny service or give you a different level of service for exercising your rights.

13. Privacy Officer and contact

Privacy Officer: [Privacy Officer name], [TokenNo North America entity legal name]
Email: info@tokenno.com
Postal address: [registered address]
[Placeholder: designated representative or agent for any state where required. Counsel to confirm.]

14. Our commitment and changes to this policy

We will handle personal information as this policy describes. The Federal Trade Commission Act (Section 5, 15 U.S.C. § 45) prohibits unfair or deceptive practices, and we intend our statements here to be accurate and complete.

We may update this policy, for example when we launch Phase 2 features. If we make material changes, we will tell you in the app or by message before they take effect. Where the law requires, we will ask for your consent. The "Last updated" date at the top shows when the policy last changed.