Privacy policy

01 / Who controls your data

Digital Cotton, operating as tokens to agents, is the data controller for information collected through this site. Questions, requests, and deletion requests go to info@tokenstoagents.com.

02 / Forms you submit

When you send the early-access form or an enterprise inquiry, the fields you type are delivered to us by email through Web3Forms, a form-handling service. We use what you send to reply to you and to follow up about the pack. We do not add you to a marketing list without your say-so.

03 / Payments and licenses

Purchases are handled by Polar, our merchant of record. Polar processes your payment, issues your license key, and manages renewals. Your card details are handled by Polar under their own privacy terms and never touch this site. We receive the license and order information we need to support your account, not your card number.

04 / Analytics

We use Vercel Analytics to count visits and see which pages are read. It measures traffic in aggregate. It does not build a personal profile of you and does not track you across other sites.

05 / Cookies

The public pages set no tracking cookies. If you sign in to the gated client area, we set two session cookies, tta_gate and tta_gate_exp, so the login works and the session timer can count down. They are session-scoped, cleared when you close the browser, and are not used to track you.

One exception worth naming: when you open checkout, Polar's payment page loads in a frame on our page, and Polar sets its own strictly necessary cookies there under its own policy. We do not set or read them.

06 / What we do not do

No advertising trackers. No third-party ad networks. No selling or renting your data to anyone. We do not use your data to train models. The pack itself makes no network calls and sends us nothing from your repo.

07 / Why we are allowed to process it

If you are in the UK or the European Economic Area, the UK GDPR and EU GDPR require us to name a legal basis for each use. Ours are straightforward. We process your purchase and license data to perform the contract you entered when you bought a license. We process form submissions and support email on the basis of our legitimate interest in answering people who contact us, and yours in getting an answer. We process aggregate analytics on the basis of our legitimate interest in understanding which pages are read. Where we ever rely on consent, you can withdraw it at any time.

08 / Who else handles it

Web3Forms delivers form submissions to us by email, and Vercel hosts the site and provides aggregate analytics. Both act as our processors, handling data only to provide their service to us.

Polar is different, and the distinction matters for your rights. As merchant of record Polar is the seller of the transaction, which makes it an independent controller of your payment, tax, and fraud data, not our processor. It decides how it handles that data, under its own privacy policy, and you can exercise your rights directly with Polar for anything connected to the payment itself.

09 / International transfers

We operate from the United States and our processors are based in the United States and Europe. If you are outside the United States, your data is transferred there. Where the GDPR requires a transfer mechanism, our processors rely on the European Commission's Standard Contractual Clauses. You may ask us which mechanism applies to a given processor.

10 / How long we keep it

Purchase and license records are kept for as long as the license is active, and afterwards for as long as tax and accounting law requires us to keep them, which is generally seven years. Form submissions and support email are kept for up to two years after our last exchange, so we have context if you come back. Aggregate analytics carry no personal profile and are kept indefinitely.

11 / Your rights

Wherever you live, you can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, ask us to restrict or stop a particular use, or ask for it in a portable format. If you are in the UK or the EEA, those rights come from the GDPR and include the right to object to processing based on legitimate interests. If you are in California, the CCPA gives you the rights to know, delete, correct, and opt out of sale or sharing; we do not sell or share your personal information, so there is nothing to opt out of.

To use any of these, email info@tokenstoagents.com. We will not charge you or treat you differently for asking, and we aim to respond within 30 days. If you are in the UK or the EEA and you think we have got it wrong, you also have the right to complain to your local supervisory authority.

12 / Children

This is a developer tool sold to businesses and professionals. It is not directed to children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has given us data, email us and we will delete it.

13 / Changes, and how to reach us

If this policy changes, the "last updated" date above changes with it, and material changes will be noted on this page. Questions, requests, and complaints go to info@tokenstoagents.com. This policy is current as of July 30, 2026.