Privacy Policy

Version 2026-06-03 · Last updated October 10, 2026

1) Scope and commitments

This Privacy Policy explains how Toecial collects, uses, stores, and protects personal data. Toecial is operated primarily in the United States and is committed to respecting privacy rights under applicable U.S. and international privacy laws.

2) Who we are / Data Controller

Toecial is a service operated by TCL Express LLC (dba Toecial), a limited liability company registered in the United States.

For privacy-related inquiries, data access or deletion requests, or to contact our privacy team: [email protected]

3) Data we collect

• Account data (username, display name, email, role, login credentials).
• Artist and user-generated content (profile data, uploaded media, captions, comments, messages).
• Technical, network, and security data (IP address, user agent, session/authentication events, policy-consent records, and anonymous technical performance telemetry such as Core Web Vitals and page load latency).
• Age, identity, and compliance verification records, including government ID data, verification status, and approved in-person verification records.
• Transaction and operational data needed to provide paid features and account support.

3a) Age, identity, and compliance verification

Artists and other users may be required to complete age or identity verification before accessing certain platform features. Verification may be performed through a third-party provider, including Didit (didit.me), or through an approved in-person verification process, including at local events where platform-authorized staff can review identity documents directly.

Online verification may involve submission of a government-issued ID, selfie or liveness check, face-match result, device/IP/session metadata, and a verification decision. Toecial receives and stores only the verification results and limited ID-derived fields needed for compliance records, fraud prevention, payment processor/card-network requirements, account review, and legal obligations.

For approved in-person verification, authorized staff may review a government-issued ID, collect a signed release or verification form, and retain a copy or scan of the ID or passport where required for compliance, 18 U.S.C. Section 2257 records, payment processor/card-network review, fraud prevention, or legal obligations. Before starting a third-party verification flow, users may also be asked to review that provider's privacy notices or consent screens.

Didit's current legal notices are available at Didit Privacy Policy, Didit Verification Privacy Notice, and Didit End User Terms for Identity Verification.

4) Media privacy and embedded metadata

Uploaded media is processed to remove embedded metadata that can identify a person or device, such as EXIF GPS location, camera/device fields, and container-level metadata in supported audio/video formats.

No automated process can remove identity cues that are visible/audible inside the content itself (for example, faces, voices, landmarks, or signs captured in an image/video).

5) How we use personal data

• Provide and secure account access, profile features, messaging, media hosting, and platform functionality.
• Process payments, payout workflows, fraud prevention, abuse prevention, and legal compliance.
• Maintain operational records, diagnostics, support workflows, and service-improvement analytics.
• Monitor site reliability, network responsiveness, and asset delivery via global edge caching and cookieless Real User Monitoring (RUM).

6) Data sales and third parties

Toecial does not sell users' personal data to third parties.

We share limited data with service providers strictly as needed to deliver, secure, and operate the platform (for example: global Content Delivery Network (CDN), web performance monitoring, and security services provided by Cloudflare, Inc.; hosting; authentication; customer payment processing via CCBill; artist payout providers; tax filing; identity/age verification providers such as Didit; or security vendors) under contractual privacy, security, and data protection obligations. Customer card processing data is handled securely by CCBill in accordance with the CCBill Privacy Policy. Artist payout providers may separately collect legal identity, bank destination, sanctions-screening, and W-8/W-9 information through their hosted onboarding tools. Toecial stores provider reference tokens, verification status, masked destination labels, payout audit records, and filing status; it does not intentionally store artist bank account or routing numbers in the payout workflow.

7) User rights and profile deletion

Every user can request permanent deletion of their profile/account at any time through the in-app "Delete Profile" flow. Deletion removes the user account and associated data from active systems, subject to any legal, tax, age/identity-verification, 18 U.S.C. Section 2257, anti-fraud, accounting, payment processor/card-network, or dispute-retention obligations that require limited records to be retained.

8) International, EU/EEA, and U.S. privacy compliance

Toecial is designed to comply with applicable data protection frameworks, including the EU General Data Protection Regulation (GDPR), the UK GDPR, and U.S. state privacy laws.

8a) European Union & UK Visitor Rights

For individuals residing in the European Union (EU), European Economic Area (EEA), or United Kingdom (UK), our processing of personal data is governed by the following legal bases under GDPR Article 6(1):

• Contractual Necessity (Art. 6(1)(b)): To register your account, manage subscriptions, deliver purchased media, and process payments or payouts.
• Legal Obligations (Art. 6(1)(c)): To comply with mandatory age verification, 18 U.S.C. Section 2257 record-keeping, anti-trafficking compliance, accounting, and tax filing laws.
• Legitimate Interests (Art. 6(1)(f)): To secure our network, prevent fraud, mitigate abuse, cache assets close to visitors via CDN, and capture anonymous, cookieless Real User Monitoring (RUM) performance metrics to optimize site speed and stability.
• Consent (Art. 6(1)(a)): For optional browser preferences and non-essential analytics cookies, which you may grant or withdraw at any time via our Cookie Settings.

Under the GDPR and UK GDPR, eligible European visitors hold specific data subject rights:

• Right of Access (Art. 15): Request confirmation and copies of personal data processed by us.
• Right to Rectification (Art. 16): Request correction of inaccurate or incomplete personal information.
• Right to Erasure (Art. 17): Request deletion of your account and data, subject to mandatory statutory retention rules.
• Right to Restriction of Processing (Art. 18): Request restricted processing under certain conditions.
• Right to Data Portability (Art. 20): Receive your personal data in a structured, commonly used format.
• Right to Object (Art. 21): Object to processing based on legitimate interests.
• Right to Withdraw Consent: Withdraw consent for optional cookies at any time via Cookie Settings.
• Supervisory Authority Complaints: Lodge a complaint with a competent Data Protection Authority in your EU/EEA member state or the UK Information Commissioner's Office (ICO).

Because Toecial is operated primarily in the United States, data collected from European visitors is transferred to the U.S. Cross-border transfers with our infrastructure and CDN partners (including Cloudflare) are protected by Standard Contractual Clauses (SCCs) and robust technical safeguards.

To exercise any GDPR or international privacy right, contact our Data Protection team at [email protected].

9) Data security and retention

We use administrative, technical, and organizational safeguards to protect personal data. Data is retained only for as long as needed for platform operations, security, legal compliance, and legitimate business purposes.

10) Policy updates

We may update this Privacy Policy from time to time. Material updates may require renewed acceptance before continued account use.

Back to login