Privacy Policy

Tolkra is an AI-powered document data-extraction service operated by Komforan ("Tolkra", "we", "us", "our"). This Privacy Policy explains what personal data we collect, how we use it, and the choices you have.

For any privacy question, or to exercise your rights, contact us at info@tolkra.com.

Account data: when you sign up we collect your email address, name, and an encrypted password credential managed by our authentication provider (Amazon Cognito).

Workspace and flow data: the workspaces, flows, field definitions, output destinations, and member roles you create in the product.

Uploaded images and extractions: photos you or your team capture are stored so the AI can analyse them, together with the structured fields extracted from each image and their confidence scores.

Billing data: if you subscribe to a paid plan, our payment processor (Stripe) handles your card details. We never see or store full card numbers; we retain only a customer and subscription identifier.

Technical data: standard information such as browser type and log data generated when you use the app.

To provide the service: authenticate you, run your flows, analyse the images you submit, and deliver results to the outputs you configure (email, webhook, or CSV export).

To operate and secure the platform, prevent abuse, and troubleshoot problems.

To manage billing and subscriptions for paid plans.

To communicate with you about your account, including invitations, security notices, and service updates.

Images you submit are analysed by a large language vision model hosted on Amazon Bedrock within the EU region. The image and your field definitions are sent to the model to produce the extracted data. We do not use your content to train third-party foundation models.

We share data only with the service providers that make the product work: Amazon Web Services (hosting, authentication, storage, and AI inference) and Stripe (payment processing). These providers act on our instructions.

If you consent to analytics cookies, Google also receives usage data about your visit (pages viewed, approximate location, device and browser) as a processor for Google Analytics and Google Ads measurement.

We do not sell your personal data. We may disclose information where required by law or to protect our rights and users.

Data is stored on Amazon Web Services infrastructure. Uploaded images are held in Amazon S3 and access is controlled through signed, time-limited URLs. We apply access controls and rely on our providers' encryption in transit and at rest.

No method of transmission or storage is completely secure, but we take reasonable measures to protect your information.

We retain account, workspace, and run data for as long as your workspace is active. Run history is preserved even when members are removed or flows are deleted, so records remain auditable. You can request deletion of your data by contacting us.

Depending on your location, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To make a request, email info@tolkra.com. If you are in the EEA or UK, you also have the right to lodge a complaint with your local data protection authority.

Tolkra uses storage that is strictly necessary to run the app — most importantly the sign-in session that keeps you logged in. You are shown a notice about this on your first visit.

Analytics and advertising measurement (with your consent only): on your first visit we ask whether we may use Google cookies — Google Analytics, to understand which pages visitors use, and Google Ads conversion measurement, to see whether an advert brought you to the site and whether you then signed up. These cookies are never set unless you accept, and declining does not affect any functionality.

We use Google consent mode in its advanced configuration. This means Google's tag is present on every page but stores nothing until you accept: while consent is denied it sets no cookies and reads no identifiers, and sends Google only an anonymous, cookie-free signal that a page was viewed, which Google uses to estimate overall traffic. Advertising identifiers in the address bar are redacted while consent is denied.

You can change or withdraw your choice at any time using the "Cookie settings" link in the footer of any public page — withdrawing is as easy as giving consent.

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above. Significant changes will be communicated where appropriate.